The genius of GDPR is that it forces companies to police each other